Software Update Verification via Encrypted Key Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software update mechanisms, such as the Red Hat Package Manager (RPM), lack a method to verify the existence of a valid software installation before applying updates, leading to administrative overhead and potential unauthorized use when distributing updates freely.
Innovation Solution
The method involves encrypting software update packages using a key file from the original installation, requiring users to provide a matching key file for decryption, ensuring only licensed users can access and install updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If RPM provides all software files as an entire re-installation for updates, then the update mechanism is simple to implement, but it prevents verification of licensed installation and allows unauthorized use
Solution Approach 1:
The patent introduces an intermediary verification mechanism using a verification token stored in the RPM header and a corresponding verification key on the server. This intermediary authentication system allows the system to verify licensed installation without changing the fundamental RPM update mechanism, resolving the contradiction between simplicity and reliability.
Solution Approach 2:
The patent applies preliminary action by verifying the licensed installation status before allowing the update process to proceed. The verification token is checked in advance during the update initiation phase, ensuring that only licensed users can access and install updates, thus preventing unauthorized use while maintaining simplicity.
2Reliability
If the verification process requires extensive database tracking and secure notification of updates, then licensed installation verification is reliable, but administrative overhead increases significantly
Solution Approach 1:
The patent implements self-service by enabling the RPM system to perform verification automatically using tokens stored in the RPM header itself. The system verifies licensed installation autonomously during the update process without requiring extensive database tracking or manual administrative intervention, thus reducing overhead while maintaining reliability.
Solution Approach 2:
The patent uses copying by distributing verification tokens with the RPM packages themselves. Instead of maintaining a centralized database of licensed users, the verification information is copied into the RPM header, allowing the system to verify licensing status locally without extensive administrative infrastructure.
3Ease of operation
If updates are distributed freely on a website, then ease of access for users is improved, but unauthorized installation and use increases
Solution Approach 1:
The patent introduces an intermediary verification layer between the freely accessible update website and the actual installation process. The verification token in the RPM header acts as a mediator that authenticates licensed users during installation, allowing free access while preventing unauthorized use through automated verification.
Solution Approach 2:
The patent implements feedback by incorporating verification mechanisms that provide immediate feedback during the installation process. The system checks the verification token and provides feedback to both the user and the administrator, allowing unauthorized installation attempts to be detected and prevented while maintaining ease of access for licensed users.
Data Source
AI summary
Systems, methods and media for verifying the existence of a licensed software installation at the time of an update to the software are disclosed. In one embodiment, a package of files for the update is encrypted with a copy of a key file that is contained in the original installation. The encrypted package of files is stored at a remote location that is accessible by way of a website. When a user seeks to download an update, the user must provide a copy of the key file used to encrypt the data. The user-provided key file is then used to decrypt the encrypted package.